Advisory Text :  

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

mvnForum Cross Site Scripting Vulnerability

Original release date: 2008-04-27

Last revised: 2008-05-06

Latest version:
http://users.own-hero.net/~decoder/advisories/mvnforum-jsxss.txt

Source: Christian Holler <http://users.own-hero.net/~decoder/>

Systems Affected:

mvnForum 1.1 (http://www.mvnforum.com/) - A Java J2EE/Jsp/Servlet forum

Severity: Moderate

Overview:

An attacker who has the rights to start a new thread or to reply

to an existing one, is able to include javascript code using the topic,

that is executed when other users use the quick reply button shown

for every post.

This point of injection is possible because the topic text is part

of an "onclick" event used for the quick reply function and the

software only escapes characters that are typical for HTML cross

site script attacks. In this case, the single quote character is not

escaped.

I. Description

The list of standard functions for threads includes a typical feature

called "quick reply". For user convenience, each post has a button that

jumps to the form field allowing to send a quick reply, whilst changing

the topic text of the reply at the top of this form. This is
accomplished

using javascript and the topic that is replied to. The source code for

this button looks like this:

<a href="#message" onclick="QuickReply('24','Re: Some thread topic');">

<img src="/forum/mvnplugin/mvnforum/images/icon/button_quick_reply.gif"

border="0" alt="Quick reply to this post" title="Quick reply to this
post" /></a>

Because single quotes are not escaped in the topic context, it is
possible

to break out of the second argument and execute arbitrary javascript
code

in the client's browser.

II. Impact

Any user that is allowed to post anywhere can use this flaw to steal

sensitive information such as cookies from other users. Especially

because the forum uses simple reusable MD5 hashes in their cookies,

this attack makes it possible to gain unauthorized access to other

user accounts.

However, this attack relies on the user to click the quick reply

button and should therefore be considered only a moderate risk.

III. Proof of concept

Creating a new thread or replying to a thread with the following
subject

will demonstrate the problem after hitting the "quick reply" button
above

the post text.

Test', alert('XSS ALERT') , '

IV. Solution

At the time of writing, a fix is available in CVS.

http://mvnforum.cvs.sourceforge.net/mvnforum/mvnforum/srcweb/mvnplugin/m

vnforum/user/viewthread.jsp?r1=1.316&r2=1.317

Timeline:

2008-04-27: mvnForum authors informed

2008-05-01: Fix available in CVS

2008-05-06: Vulnerability notice published

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.6 (GNU/Linux)

iD8DBQFIIMEXJQIKXnJyDxURAlOPAJ96XH9zfjLJ1jMjCCpheurxwJuqMACfbz2S

FWggJDc19FDPXiiyS+AP9iU=

=Tixo

-----END PGP SIGNATURE-----